<html>
<head><meta charset="utf-8"><title>Casting pointer to integer still triggers UB · t-lang/wg-unsafe-code-guidelines · Zulip Chat Archive</title></head>
<h2>Stream: <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/index.html">t-lang/wg-unsafe-code-guidelines</a></h2>
<h3>Topic: <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Casting.20pointer.20to.20integer.20still.20triggers.20UB.html">Casting pointer to integer still triggers UB</a></h3>

<hr>

<base href="https://rust-lang.zulipchat.com">

<head><link href="https://rust-lang.github.io/zulip_archive/style.css" rel="stylesheet"></head>

<a name="229108933"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Casting%20pointer%20to%20integer%20still%20triggers%20UB/near/229108933" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> hyd-dev <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Casting.20pointer.20to.20integer.20still.20triggers.20UB.html#229108933">(Mar 06 2021 at 16:08)</a>:</h4>
<p>I came across this code in <a href="https://github.com/rust-lang/unsafe-code-guidelines/issues/134">https://github.com/rust-lang/unsafe-code-guidelines/issues/134</a>:</p>
<div class="codehilite" data-code-language="Rust"><pre><span></span><code><span class="kd">let</span><span class="w"> </span><span class="n">val</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="p">[</span><span class="mi">1</span><span class="k">u8</span><span class="p">,</span><span class="w"> </span><span class="mi">2</span><span class="p">];</span><span class="w"></span>
<span class="kd">let</span><span class="w"> </span><span class="n">ptr</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="o">&amp;</span><span class="n">val</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span><span class="w"> </span><span class="k">as</span><span class="w"> </span><span class="o">*</span><span class="k">const</span><span class="w"> </span><span class="kt">u8</span><span class="p">;</span><span class="w"></span>
<span class="kd">let</span><span class="w"> </span><span class="n">_val</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="k">unsafe</span><span class="w"> </span><span class="p">{</span><span class="w"> </span><span class="o">*</span><span class="n">ptr</span><span class="p">.</span><span class="n">add</span><span class="p">(</span><span class="mi">1</span><span class="p">)</span><span class="w"> </span><span class="p">};</span><span class="w"></span>
</code></pre></div>
<p>According to the issue, that code has UB due to "surrounding" element access.<br>
As the <code>pointer::add</code> documentation states "consider using <code>wrapping_add</code> instead if these constraints are difficult to satisfy", and the <code>wrapping_add</code> documentation says "if you need to cross object boundaries, cast the pointer to an integer and do the arithmetic there", I tried if doing some pointer-integer casts helps:</p>
<div class="codehilite" data-code-language="Rust"><pre><span></span><code><span class="k">fn</span> <span class="nf">main</span><span class="p">()</span><span class="w"> </span><span class="p">{</span><span class="w"></span>
<span class="w">    </span><span class="kd">let</span><span class="w"> </span><span class="n">val</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="p">[</span><span class="mi">1</span><span class="k">u8</span><span class="p">,</span><span class="w"> </span><span class="mi">2</span><span class="p">];</span><span class="w"></span>
<span class="w">    </span><span class="kd">let</span><span class="w"> </span><span class="n">ptr</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="o">&amp;</span><span class="n">val</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span><span class="w"> </span><span class="k">as</span><span class="w"> </span><span class="o">*</span><span class="k">const</span><span class="w"> </span><span class="kt">u8</span><span class="p">;</span><span class="w"></span>
<span class="w">    </span><span class="kd">let</span><span class="w"> </span><span class="n">_val</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="k">unsafe</span><span class="w"> </span><span class="p">{</span><span class="w"> </span><span class="o">*</span><span class="p">((</span><span class="n">ptr</span><span class="w"> </span><span class="k">as</span><span class="w"> </span><span class="kt">usize</span><span class="w"> </span><span class="o">+</span><span class="w"> </span><span class="mi">1</span><span class="p">)</span><span class="w"> </span><span class="k">as</span><span class="w"> </span><span class="o">*</span><span class="k">const</span><span class="w"> </span><span class="kt">u8</span><span class="p">)</span><span class="w"> </span><span class="p">};</span><span class="w"></span>
<span class="p">}</span><span class="w"></span>
</code></pre></div>
<p>Unfortunately Miri still didn't like that:</p>
<div class="codehilite"><pre><span></span><code>error: Undefined Behavior: no item granting read access to tag &lt;untagged&gt; at alloc1386+0x1 found in borrow stack.
 --&gt; src/main.rs:4:25
  |
4 |     let _val = unsafe { *((ptr as usize + 1) as *const u8) };
  |                         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ no item granting read access to tag &lt;untagged&gt; at alloc1386+0x1 found in borrow stack.
  |
  = help: this indicates a potential bug in the program: it performed an invalid operation, but the rules it violated are still experimental
  = help: see https://github.com/rust-lang/unsafe-code-guidelines/blob/master/wip/stacked-borrows.md for further information
</code></pre></div>
<p>Therefore I must either misunderstood what "crossing object boundaries" is or some of the Stacked Borrows rule can't be "relaxed" by "casting the pointer to an integer and do the arithmetic there" (or I "casted the pointer to an integer" wrongly, if I have some silly mistakes in the code).</p>
<p>Could someone explain what I am missing? Any help would be appreciate!</p>



<a name="229109093"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Casting%20pointer%20to%20integer%20still%20triggers%20UB/near/229109093" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Lokathor <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Casting.20pointer.20to.20integer.20still.20triggers.20UB.html#229109093">(Mar 06 2021 at 16:10)</a>:</h4>
<p>i think this is one of those things where it's illegal under stacked borrows but still works in practice under llvm.</p>
<p>what should work for both is <code>val.as_ptr().add(1)</code></p>



<a name="229109242"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Casting%20pointer%20to%20integer%20still%20triggers%20UB/near/229109242" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Thales Fragoso <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Casting.20pointer.20to.20integer.20still.20triggers.20UB.html#229109242">(Mar 06 2021 at 16:12)</a>:</h4>
<p><span class="user-mention" data-user-id="224471">@Lokathor</span> how about the whole thing with integers with provenance ?</p>



<a name="229109397"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Casting%20pointer%20to%20integer%20still%20triggers%20UB/near/229109397" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Lokathor <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Casting.20pointer.20to.20integer.20still.20triggers.20UB.html#229109397">(Mar 06 2021 at 16:14)</a>:</h4>
<p>unfortunately I'm on phone and don't recall all the different ways things can go wrong and why... but i do remember that using as_ptr is the fix.</p>
<p>the reason is that as_ptr does the conversion in this specific order:<br>
&amp;[T] // provenance to the whole span<br>
*const [T] // still the whole span<br>
*const T // head of the span</p>



<a name="229109533"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Casting%20pointer%20to%20integer%20still%20triggers%20UB/near/229109533" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Thales Fragoso <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Casting.20pointer.20to.20integer.20still.20triggers.20UB.html#229109533">(Mar 06 2021 at 16:16)</a>:</h4>
<p>Yeah, as_ptr should be okay, I was talking about the ptr to integer to pointer thingy</p>



<a name="229109616"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Casting%20pointer%20to%20integer%20still%20triggers%20UB/near/229109616" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> hyd-dev <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Casting.20pointer.20to.20integer.20still.20triggers.20UB.html#229109616">(Mar 06 2021 at 16:18)</a>:</h4>
<p>Yes. What confused me here is casting the pointer to integer doesn't seem to "lose" the provenance.</p>



<a name="229110000"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Casting%20pointer%20to%20integer%20still%20triggers%20UB/near/229110000" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Casting.20pointer.20to.20integer.20still.20triggers.20UB.html#229110000">(Mar 06 2021 at 16:24)</a>:</h4>
<p><span class="user-mention silent" data-user-id="374396">hyd-dev</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/Casting.20pointer.20to.20integer.20still.20triggers.20UB/near/229109616">said</a>:</p>
<blockquote>
<p>Yes. What confused me here is casting the pointer to integer doesn't seem to "lose" the provenance.</p>
</blockquote>
<p>why should it, though? that is not the intention of ptr-int-casts</p>



<a name="229110043"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Casting%20pointer%20to%20integer%20still%20triggers%20UB/near/229110043" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Casting.20pointer.20to.20integer.20still.20triggers.20UB.html#229110043">(Mar 06 2021 at 16:25)</a>:</h4>
<p>ideally, if you cast a ptr to an int and back, you'll get the same provenance as what you started with. we cannot always do that since ints cannot carry provenance, but we can at least ensure that you cannot use this to access bytes <em>that never had a pointer to them cast to an int</em>.<br>
If you could do that, we'd throw all these nice aliasing-based optimizations out the window.</p>



<a name="229110068"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Casting%20pointer%20to%20integer%20still%20triggers%20UB/near/229110068" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Thales Fragoso <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Casting.20pointer.20to.20integer.20still.20triggers.20UB.html#229110068">(Mar 06 2021 at 16:25)</a>:</h4>
<p>Weird that the docs suggest that</p>



<a name="229110791"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Casting%20pointer%20to%20integer%20still%20triggers%20UB/near/229110791" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Lokathor <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Casting.20pointer.20to.20integer.20still.20triggers.20UB.html#229110791">(Mar 06 2021 at 16:36)</a>:</h4>
<p>yeah the docs shouldn't suggest something that nearly-never works (in the "no, that's UB" sense)</p>



<a name="229111083"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Casting%20pointer%20to%20integer%20still%20triggers%20UB/near/229111083" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Casting.20pointer.20to.20integer.20still.20triggers.20UB.html#229111083">(Mar 06 2021 at 16:40)</a>:</h4>
<p>Oh that's what you mean... hm</p>



<a name="229111108"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Casting%20pointer%20to%20integer%20still%20triggers%20UB/near/229111108" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> hyd-dev <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Casting.20pointer.20to.20integer.20still.20triggers.20UB.html#229111108">(Mar 06 2021 at 16:40)</a>:</h4>
<p><span class="user-mention silent" data-user-id="120791">RalfJ</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/Casting.20pointer.20to.20integer.20still.20triggers.20UB/near/229110000">said</a>:</p>
<blockquote>
<p>why should it, though? that is not the intention of ptr-int-casts</p>
</blockquote>
<p>As what <span class="user-mention silent" data-user-id="267734">Thales Fragoso</span> and <span class="user-mention silent" data-user-id="224471">Lokathor</span>  said, at least the documentation suggest me to do that... and the discussion in <a href="https://github.com/rust-lang/rust/issues/56698">#56698</a> seems saying that casting the pointer to integer can "lose" the provenance, too... unless some words are overloaded and I didn't get them right. (Clarification appreciate!)</p>



<a name="229111132"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Casting%20pointer%20to%20integer%20still%20triggers%20UB/near/229111132" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Casting.20pointer.20to.20integer.20still.20triggers.20UB.html#229111132">(Mar 06 2021 at 16:41)</a>:</h4>
<p>part of the problem is that "is the arithmetic allowed" and "is using the resulting pointer allowed" are two very different questions (but most people don't know that)</p>



<a name="229111151"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Casting%20pointer%20to%20integer%20still%20triggers%20UB/near/229111151" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Casting.20pointer.20to.20integer.20still.20triggers.20UB.html#229111151">(Mar 06 2021 at 16:41)</a>:</h4>
<p><span class="user-mention silent" data-user-id="374396">hyd-dev</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/Casting.20pointer.20to.20integer.20still.20triggers.20UB/near/229111108">said</a>:</p>
<blockquote>
<p><span class="user-mention silent" data-user-id="120791">RalfJ</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/Casting.20pointer.20to.20integer.20still.20triggers.20UB/near/229110000">said</a>:</p>
<blockquote>
<p>why should it, though? that is not the intention of ptr-int-casts</p>
</blockquote>
<p>As what <span class="user-mention silent" data-user-id="267734">Thales Fragoso</span> and <span class="user-mention silent" data-user-id="224471">Lokathor</span>  said, at least the documentation suggest me to do that... and the discussion in <a href="https://github.com/rust-lang/rust/issues/56698">#56698</a> seems saying that casting the pointer to integer can "lose" the provenance, too... unless some words are overloaded and I didn't get them right. (Clarification appreciate!)</p>
</blockquote>
<p>it <em>can</em> lose provenance, but that doesnt mean that it always will</p>



<a name="229111223"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Casting%20pointer%20to%20integer%20still%20triggers%20UB/near/229111223" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Casting.20pointer.20to.20integer.20still.20triggers.20UB.html#229111223">(Mar 06 2021 at 16:42)</a>:</h4>
<p>it will only lose provenance when that's unavoidable, but generally everything attempts as much as it can to preserve provenance</p>



<a name="229111242"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Casting%20pointer%20to%20integer%20still%20triggers%20UB/near/229111242" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Thales Fragoso <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Casting.20pointer.20to.20integer.20still.20triggers.20UB.html#229111242">(Mar 06 2021 at 16:42)</a>:</h4>
<p>But doesn't wrapping_add always allow arithmetic ? Why would it mention integer conversion ?</p>



<a name="229111316"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Casting%20pointer%20to%20integer%20still%20triggers%20UB/near/229111316" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Casting.20pointer.20to.20integer.20still.20triggers.20UB.html#229111316">(Mar 06 2021 at 16:43)</a>:</h4>
<p>in cases where the other object you are moving to has had ptrs cast to integers, you can do cross-obj arithmetic via integers but not via <code>wrapping_add</code>.</p>



<a name="229111375"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Casting%20pointer%20to%20integer%20still%20triggers%20UB/near/229111375" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Casting.20pointer.20to.20integer.20still.20triggers.20UB.html#229111375">(Mar 06 2021 at 16:44)</a>:</h4>
<p>wrapping_add just places an <em>additional</em> constraint that you must stay within the same object, and that constraint can be avoided by using integers</p>



<a name="229111397"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Casting%20pointer%20to%20integer%20still%20triggers%20UB/near/229111397" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Casting.20pointer.20to.20integer.20still.20triggers.20UB.html#229111397">(Mar 06 2021 at 16:44)</a>:</h4>
<p>however, to actually be able to access something, there are more things you need to consider (and wrapping_offset seems like the wrong place to discuss them)</p>



<a name="229111429"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Casting%20pointer%20to%20integer%20still%20triggers%20UB/near/229111429" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Casting.20pointer.20to.20integer.20still.20triggers.20UB.html#229111429">(Mar 06 2021 at 16:45)</a>:</h4>
<p>in particular, to access something with a ptr cast from an int, that something must have previously had a ptr cast <em>to</em> an int and that ptr must still have the permission to access this data</p>



<a name="229111441"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Casting%20pointer%20to%20integer%20still%20triggers%20UB/near/229111441" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Thales Fragoso <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Casting.20pointer.20to.20integer.20still.20triggers.20UB.html#229111441">(Mar 06 2021 at 16:45)</a>:</h4>
<p>The suggestion still seems a bit off putting</p>



<a name="229111456"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Casting%20pointer%20to%20integer%20still%20triggers%20UB/near/229111456" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Thales Fragoso <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Casting.20pointer.20to.20integer.20still.20triggers.20UB.html#229111456">(Mar 06 2021 at 16:45)</a>:</h4>
<p>It doesn't really specify the cases</p>



<a name="229111460"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Casting%20pointer%20to%20integer%20still%20triggers%20UB/near/229111460" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Casting.20pointer.20to.20integer.20still.20triggers.20UB.html#229111460">(Mar 06 2021 at 16:45)</a>:</h4>
<p>fair. but entirely removing it also doesn't seem right (see the comments in <a href="https://github.com/rust-lang/rust/issues/56698">#56698</a>)</p>



<a name="229111822"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Casting%20pointer%20to%20integer%20still%20triggers%20UB/near/229111822" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> hyd-dev <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Casting.20pointer.20to.20integer.20still.20triggers.20UB.html#229111822">(Mar 06 2021 at 16:50)</a>:</h4>
<p><span class="user-mention silent" data-user-id="120791">RalfJ</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/Casting.20pointer.20to.20integer.20still.20triggers.20UB/near/229111429">said</a>:</p>
<blockquote>
<p>in particular, to access something with a ptr cast from an int, that something must have previously had a ptr cast <em>to</em> an int and that ptr must still have the permission to access this data</p>
</blockquote>
<p>That seems as unfortunate as removing that suggestion. <span aria-label="sad" class="emoji emoji-2639" role="img" title="sad">:sad:</span></p>



<a name="229111856"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Casting%20pointer%20to%20integer%20still%20triggers%20UB/near/229111856" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Casting.20pointer.20to.20integer.20still.20triggers.20UB.html#229111856">(Mar 06 2021 at 16:51)</a>:</h4>
<p>you mean you'd prefer the semantics to work differently? again, then we'd be throwing basically all of alias analysis out of the window</p>



<a name="229111864"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Casting%20pointer%20to%20integer%20still%20triggers%20UB/near/229111864" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Casting.20pointer.20to.20integer.20still.20triggers.20UB.html#229111864">(Mar 06 2021 at 16:51)</a>:</h4>
<p>this is the price we have to pay if we dont want to fall waaay behind safe languages (without notable unsafe fragments) in terms of optimizations</p>



<a name="229112216"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Casting%20pointer%20to%20integer%20still%20triggers%20UB/near/229112216" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> hyd-dev <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Casting.20pointer.20to.20integer.20still.20triggers.20UB.html#229112216">(Mar 06 2021 at 16:57)</a>:</h4>
<p><span class="user-mention silent" data-user-id="120791">RalfJ</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/Casting.20pointer.20to.20integer.20still.20triggers.20UB/near/229111856">said</a>:</p>
<blockquote>
<p>you mean you'd prefer the semantics to work differently? again, then we'd be throwing basically all of alias analysis out of the window</p>
</blockquote>
<p>Not really... I think I need to consider carefully to decide how "unfortunate" it is. <span aria-label="sweat smile" class="emoji emoji-1f605" role="img" title="sweat smile">:sweat_smile:</span></p>



<a name="229113121"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Casting%20pointer%20to%20integer%20still%20triggers%20UB/near/229113121" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Casting.20pointer.20to.20integer.20still.20triggers.20UB.html#229113121">(Mar 06 2021 at 17:09)</a>:</h4>
<p>Meanwhile, it's certainly welcome suggestions for how to improve the docs :)</p>



<a name="229113228"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Casting%20pointer%20to%20integer%20still%20triggers%20UB/near/229113228" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> hyd-dev <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Casting.20pointer.20to.20integer.20still.20triggers.20UB.html#229113228">(Mar 06 2021 at 17:11)</a>:</h4>
<p><span class="user-mention silent" data-user-id="120791">RalfJ</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/Casting.20pointer.20to.20integer.20still.20triggers.20UB/near/229113121">said</a>:</p>
<blockquote>
<p>Meanwhile, it's certainly welcome suggestions for how to improve the docs :)</p>
</blockquote>
<p>I think it should at least explain "to access something with a ptr cast from an int, that something must have previously had a ptr cast to an int and that ptr must still have the permission to access this data".</p>



<a name="229113265"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Casting%20pointer%20to%20integer%20still%20triggers%20UB/near/229113265" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Casting.20pointer.20to.20integer.20still.20triggers.20UB.html#229113265">(Mar 06 2021 at 17:11)</a>:</h4>
<p>but why would wrapping_offset be the place to explain that? that's now int-ptr-casts work in general, independent of any arithmetic</p>



<a name="229113340"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Casting%20pointer%20to%20integer%20still%20triggers%20UB/near/229113340" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Casting.20pointer.20to.20integer.20still.20triggers.20UB.html#229113340">(Mar 06 2021 at 17:12)</a>:</h4>
<p>(this is also true in C/C++ btw, though the standard is not precise enough to say what the granularity is -- at least some ptr into an allocation must have been cast to an int to allow accessing any part of the allocation with a ptr cast from an int; depending on how precisely you read the object model, there might be further restrictions)</p>



<a name="229113602"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Casting%20pointer%20to%20integer%20still%20triggers%20UB/near/229113602" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Thales Fragoso <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Casting.20pointer.20to.20integer.20still.20triggers.20UB.html#229113602">(Mar 06 2021 at 17:16)</a>:</h4>
<p>If it's no place to explain ptr to int casts, why suggest it without further info in the first case ?</p>



<a name="229114130"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Casting%20pointer%20to%20integer%20still%20triggers%20UB/near/229114130" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Lokathor <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Casting.20pointer.20to.20integer.20still.20triggers.20UB.html#229114130">(Mar 06 2021 at 17:24)</a>:</h4>
<p>either wrapping_offset should say the extra rule about ptr/int mechanics OR it shouldn't suggest trying to bypass limits using int math, but saying "use int math" and then not adding "also if you do remember this rule" is just very bad.</p>



<a name="229114177"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Casting%20pointer%20to%20integer%20still%20triggers%20UB/near/229114177" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Lokathor <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Casting.20pointer.20to.20integer.20still.20triggers.20UB.html#229114177">(Mar 06 2021 at 17:25)</a>:</h4>
<p>you can't assume people read every bit of documentation everywhere, <em>most</em> rules should appear in more than one place.</p>



<a name="229114217"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Casting%20pointer%20to%20integer%20still%20triggers%20UB/near/229114217" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> hyd-dev <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Casting.20pointer.20to.20integer.20still.20triggers.20UB.html#229114217">(Mar 06 2021 at 17:26)</a>:</h4>
<p><span class="user-mention silent" data-user-id="120791">RalfJ</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/Casting.20pointer.20to.20integer.20still.20triggers.20UB/near/229113265">said</a>:</p>
<blockquote>
<p>but why would wrapping_offset be the place to explain that? that's now int-ptr-casts work in general, independent of any arithmetic</p>
</blockquote>
<p>Because the <code>wrapping_(add|sub|offset)</code> documentation suggests to do such casts.</p>
<p>With regard to the C/C++ part, as Rust is more relaxed / very different in some places for optimizations comparing to C/C++, someone (like me) could (foolishly <span aria-label="sob" class="emoji emoji-1f62d" role="img" title="sob">:sob:</span>) assume that if the documentation does not say so, such requirement does not apply to Rust.</p>



<a name="229115413"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Casting%20pointer%20to%20integer%20still%20triggers%20UB/near/229115413" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> hyd-dev <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Casting.20pointer.20to.20integer.20still.20triggers.20UB.html#229115413">(Mar 06 2021 at 17:45)</a>:</h4>
<p>But I think if such rules are explained elsewhere, and if there's a <em>link</em> to them in the documentation of <code>wrapping_(add|sub|offset)</code>, it's also acceptable.</p>



<a name="229119453"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Casting%20pointer%20to%20integer%20still%20triggers%20UB/near/229119453" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Casting.20pointer.20to.20integer.20still.20triggers.20UB.html#229119453">(Mar 06 2021 at 18:44)</a>:</h4>
<p>Unfortunately, the exact rules for int-ptr-casts are not even know.n :/  Precisely specifying a memory model such as Rusts is really tricky, and so far no proposal exists that fits all the constraints wrt. what code people want to write and what optimizations compilers want to do.<br>
(That is also true for C/C++ but their specs fail to acknowledge these gaps.)</p>



<a name="229119516"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Casting%20pointer%20to%20integer%20still%20triggers%20UB/near/229119516" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Casting.20pointer.20to.20integer.20still.20triggers.20UB.html#229119516">(Mar 06 2021 at 18:44)</a>:</h4>
<p>So, we're basically building on quicksand and making things up as we go.^^ Ideally we'd simply forbid int-ptr-casts until they were actually understood, but, well, I doubt I would get very far with that proposal. ;)</p>



<a name="229119634"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Casting%20pointer%20to%20integer%20still%20triggers%20UB/near/229119634" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Thales Fragoso <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Casting.20pointer.20to.20integer.20still.20triggers.20UB.html#229119634">(Mar 06 2021 at 18:46)</a>:</h4>
<p>Yeah, you still need MMIO</p>



<a name="229119638"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Casting%20pointer%20to%20integer%20still%20triggers%20UB/near/229119638" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Casting.20pointer.20to.20integer.20still.20triggers.20UB.html#229119638">(Mar 06 2021 at 18:46)</a>:</h4>
<p>So, meanwhile, I have no idea what the best course is in terms of documentation. I want to avoid making promises that cannot be held once we actually figure out a proper spec.</p>



<a name="229119714"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Casting%20pointer%20to%20integer%20still%20triggers%20UB/near/229119714" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Casting.20pointer.20to.20integer.20still.20triggers.20UB.html#229119714">(Mar 06 2021 at 18:47)</a>:</h4>
<p>if everyone agrees that that sentence is better removed from the docs, then I wont block that.</p>



<a name="229119793"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Casting%20pointer%20to%20integer%20still%20triggers%20UB/near/229119793" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Casting.20pointer.20to.20integer.20still.20triggers.20UB.html#229119793">(Mar 06 2021 at 18:48)</a>:</h4>
<p>However, while I agree with many of the points that were raised here, I really dont understand how one could imagine that this sentence applies to your example, <span class="user-mention" data-user-id="374396">@hyd-dev</span>. You dont even have multiple allocations ("allocated objects") there, you are doing arithmetic within one allocation.</p>



<a name="229119859"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Casting%20pointer%20to%20integer%20still%20triggers%20UB/near/229119859" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Casting.20pointer.20to.20integer.20still.20triggers.20UB.html#229119859">(Mar 06 2021 at 18:49)</a>:</h4>
<p>So there is some other misunderstanding here about what an "allocated object" is. The docs say</p>
<blockquote>
<p>Note that in Rust, every (stack-allocated) variable is considered a separate allocated object.</p>
</blockquote>



<a name="229119878"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Casting%20pointer%20to%20integer%20still%20triggers%20UB/near/229119878" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Casting.20pointer.20to.20integer.20still.20triggers.20UB.html#229119878">(Mar 06 2021 at 18:50)</a>:</h4>
<p>I originally wanted this to just say "allocation" but some people didnt like this term because they thought it would mean <em>heap</em> allocation</p>



<a name="229119960"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Casting%20pointer%20to%20integer%20still%20triggers%20UB/near/229119960" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Casting.20pointer.20to.20integer.20still.20triggers.20UB.html#229119960">(Mar 06 2021 at 18:50)</a>:</h4>
<p>I think one thing we need here is a place to define terms such as "allocated object", that we can link to here. The UCG has a glossary but thats much less official. libstd doesnt have a glossary.</p>



<a name="229120604"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Casting%20pointer%20to%20integer%20still%20triggers%20UB/near/229120604" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> hyd-dev <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Casting.20pointer.20to.20integer.20still.20triggers.20UB.html#229120604">(Mar 06 2021 at 19:01)</a>:</h4>
<p><span class="user-mention silent" data-user-id="120791">RalfJ</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/Casting.20pointer.20to.20integer.20still.20triggers.20UB/near/229119793">said</a>:</p>
<blockquote>
<p>However, while I agree with many of the points that were raised here, I really dont understand how one could imagine that this sentence applies to your example, <span class="user-mention silent" data-user-id="374396">hyd-dev</span>. You dont even have multiple allocations ("allocated objects") there, you are doing arithmetic within one allocation.</p>
</blockquote>
<p>Oh... However, that means the documentation is more misleading/incomplete, it makes me feel even <code>add</code> or <code>wrapping_add</code> is sufficient. The <code># Safety</code> section does not mention the restriction <em>at all</em>.</p>
<p>Now I understand why you feel explaining the restriction in the documentation of <code>wrapping_*</code> is not suitable.</p>



<a name="229121085"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Casting%20pointer%20to%20integer%20still%20triggers%20UB/near/229121085" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> hyd-dev <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Casting.20pointer.20to.20integer.20still.20triggers.20UB.html#229121085">(Mar 06 2021 at 19:08)</a>:</h4>
<p><span class="user-mention silent" data-user-id="374396">hyd-dev</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/Casting.20pointer.20to.20integer.20still.20triggers.20UB/near/229108933">said</a>:</p>
<blockquote>
<p>Therefore I must either misunderstood what "crossing object boundaries" is or some of the Stacked Borrows rule can't be "relaxed" by "casting the pointer to an integer and do the arithmetic there"</p>
</blockquote>
<p>Sounds like I misunderstood <em>both</em>... thanks for explanation!</p>



<a name="229121167"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Casting%20pointer%20to%20integer%20still%20triggers%20UB/near/229121167" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Casting.20pointer.20to.20integer.20still.20triggers.20UB.html#229121167">(Mar 06 2021 at 19:09)</a>:</h4>
<p>yeah... provenance is a restriction that applies to <em>all</em> pointer operations, both the explicit ones (<code>wrapping_add</code> etc) and the implicit ones (<code>&amp;(*x).field</code> etc). also, it is indeed basically undocumented, since Rust has not yet committed to a memory model.</p>



<a name="229121257"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Casting%20pointer%20to%20integer%20still%20triggers%20UB/near/229121257" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Casting.20pointer.20to.20integer.20still.20triggers.20UB.html#229121257">(Mar 06 2021 at 19:10)</a>:</h4>
<p>ideally <code>wrapping_add</code> could simply say that the resulting ptr has the same provenance as the input, and that would be sufficient ;) (this is indeed fully defining its semantics)</p>



<a name="229121311"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Casting%20pointer%20to%20integer%20still%20triggers%20UB/near/229121311" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Casting.20pointer.20to.20integer.20still.20triggers.20UB.html#229121311">(Mar 06 2021 at 19:11)</a>:</h4>
<p>but so far we avoided talking about provenance in any concrete terms. I am not sure we even have lang-team consensus that provenance the way I imagine it is a thing (I know some lang-team members question the necessity).</p>



<a name="229121433"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Casting%20pointer%20to%20integer%20still%20triggers%20UB/near/229121433" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Casting.20pointer.20to.20integer.20still.20triggers.20UB.html#229121433">(Mar 06 2021 at 19:13)</a>:</h4>
<p>I guess there are some things we can say for sure even if we dont know the final model yet, but it'd be a lot of work to get these vetted by the lang team one by one and there'd be very justified concerns about where this is all going and whether we might be drawing ourselves into the wrong corner</p>



<a name="229122408"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Casting%20pointer%20to%20integer%20still%20triggers%20UB/near/229122408" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> hyd-dev <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Casting.20pointer.20to.20integer.20still.20triggers.20UB.html#229122408">(Mar 06 2021 at 19:28)</a>:</h4>
<p><span class="user-mention silent" data-user-id="120791">RalfJ</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/Casting.20pointer.20to.20integer.20still.20triggers.20UB/near/229119859">said</a>:</p>
<blockquote>
<p>So there is some other misunderstanding here about what an "allocated object" is. The docs say</p>
<blockquote>
<p>Note that in Rust, every (stack-allocated) variable is considered a separate allocated object.</p>
</blockquote>
</blockquote>
<p>I guess some examples in the documentation could be helpful. <span aria-label="smile" class="emoji emoji-1f642" role="img" title="smile">:smile:</span></p>



<a name="229130379"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Casting%20pointer%20to%20integer%20still%20triggers%20UB/near/229130379" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Casting.20pointer.20to.20integer.20still.20triggers.20UB.html#229130379">(Mar 06 2021 at 21:24)</a>:</h4>
<p>I'll make a note to add a definition of "allocated object" somewhere and link to it from these offsetting operations.</p>



<a name="229130417"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Casting%20pointer%20to%20integer%20still%20triggers%20UB/near/229130417" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Casting.20pointer.20to.20integer.20still.20triggers.20UB.html#229130417">(Mar 06 2021 at 21:25)</a>:</h4>
<p>But that won't help for the other sentence, the once that recommends using int arithmetic. As that old PR shows, you are not the first to be tripped by it.</p>



<a name="232108878"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Casting%20pointer%20to%20integer%20still%20triggers%20UB/near/232108878" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Casting.20pointer.20to.20integer.20still.20triggers.20UB.html#232108878">(Mar 27 2021 at 18:33)</a>:</h4>
<p><span class="user-mention silent" data-user-id="120791">RalfJ</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/Casting.20pointer.20to.20integer.20still.20triggers.20UB/near/229130379">said</a>:</p>
<blockquote>
<p>I'll make a note to add a definition of "allocated object" somewhere and link to it from these offsetting operations.</p>
</blockquote>
<p>I finally got around to doing this: <a href="https://github.com/rust-lang/rust/pull/83579">https://github.com/rust-lang/rust/pull/83579</a></p>



<hr><p>Last updated: Aug 07 2021 at 22:04 UTC</p>
</html>